Bug bounty
Last updated 18 October 2026
GraviFi pays for vulnerabilities in its vault program that put holders' funds at risk. This page is the whole policy: a report qualifies only if it fits it.
In scope
The vault program on Solana mainnet, HHmD4ZP5he9GrcmcNrpjahyK1dWh2MhMwmVpiPRJsw3G, as built from github.com/gravifi/gravifi. Nothing else is in scope.
A report qualifies when it shows how someone without any of the team's keys could:
take tokens from a basket's vault or the burn address; stop a holder from redeeming; mint shares without depositing their full value; push a fee past its ceiling or the burn below half of the protocol fee; or change a basket they don't control.
A reproduction is required
Every report must include one: a failing test for the repository's test suite (it runs the program in LiteSVM: anchor build, then npm test), or a sequence of transactions on devnet. A description alone, however detailed, doesn't qualify. Send text and links only: we never open attachments, archives or programs.
Out of scope
The team's keys. The keys that upgrade the program, run the protocol, post prices and run rebalances (whitepaper, section 8) are trusted by design. Anything that needs one of them, or follows from one being lost or misused, is a known trust assumption, not a finding.
Issuers. What a token's issuer can do to its own token: pause or freeze it, claw it back, change its transfer fee, enable a transfer hook. Holders can always redeem everything else and leave such a token in the basket.
Known issues. Anything in the whitepaper's risks (section 9) or roadmap (section 10), or in the list below.
Everything that isn't the program. The website, the app, documentation and wording, legal pages, emails, DNS and hosting settings, rate limits, other people's programs (Solana, token programs, Jupiter, wallets).
Markets. Price impact, slippage within the limits a user or keeper set, front-running of a user's own swap, and losses from prices moving.
Everything else that isn't a vulnerability: best-practice suggestions, gas or compute optimisations, theoretical issues with no demonstrated impact, denial of service, spam, social engineering, and reports from automated tools or AI without a working reproduction.
Known issues
The program and protocol authority are one team key until the multisig. The keeper's price authority and rebalancer are one key held by the app's server; rebalance and buyback floors are only as honest as the prices it posts, and limits in the program are planned. Prices are accepted for 120 seconds. A token whose issuer pauses, freezes or hooks it can't be paid out or rebalanced until the issuer stops; redeeming the rest with the forfeit mask works.
Rewards
Paid in SOL, scaled to the value actually at risk and the value the protocol holds when the report arrives. The team decides whether a report qualifies and its severity, and that decision is final.
Critical (theft or a permanent lock of holders' funds): up to 0.2 SOL. High (theft or lock that needs unlikely conditions, or of fees rather than holders' funds): up to 0.1 SOL. Medium (a broken program guarantee with limited impact): up to 0.05 SOL. Low and informational: thanks, no reward.
GraviFi is new and holds little so far, and the rewards match that. They'll grow with the value the protocol holds; this page will say when they do.
Only the first report of an issue is rewarded, and only if we didn't know about it.
Rules
Test on devnet or locally. On mainnet, act only as a normal user with your own funds: never touch other users' funds or baskets, and never run anything that degrades the service. Don't disclose an issue publicly until it's fixed. If you keep to these rules in good faith, we won't take action against you.
How to report
Write to team@gravifi.xyz with the issue, the reproduction, and the Solana address for a reward. We reply to every report that fits this page.